Licensing 101

Overview of licensing introduced to the agents

end user can license via standalone or on network via SAM (highly recommended) - SAM may be operated on air gapped network; make licensing your agents quicker

will pick up functionality on the way; v2 will incorporate configuration of the agents;

What needs a license?  Snare Agent Manager - root licenses, agent licenses,

v5+ agents and SAM v1+, Snare Server v7+ products.

  NOTE: discuss version bump from vx to v5...consistent, up to same level

Licensing from an end users perspective consists of two different pathways.

• Standalone licensing
  

  Standalone licenses can be issued for either Agents, Snare Server or SAM. In standalone mode the agent will not talk to a Snare Agent Management Console to obtain its license. It will however still talk to it to provide details to SAM about its ip, license class etc.
  A standalone license is identified by the License-Type being either: EVALUATION, FULL.

• SAM based licensing
  
  In SAM Based licensing, SAM provides the licenses to the agents.
  Licenses provided to an agent are identified by the License-Type being either: CONTROLLER-EVALUATION or CONTROLLER-FULL.

Snare Agent Manager

SAM needs to be licensed first before can license other agents.  The license for SAM uses IA_SAM=1.

Then there is a feature license for your agents:

IA_LOG

IA_MSSQL_LOG

IA_MSSQL_LOG_HOST

SAM automatically sends a license (generated by itself) once a day to the agents, so the agents perpertually license for another 30 days,so if network is down the agents will log for another 30-days.

If after network is up, SAM will resend a license of internal (todays date) plus another 30 days.

THEREFORE agents will keep on logging for 30 days after they last communicated with SAM.

(Last Seen is the last time the agent contacted SAM, or if did a scan that SAM saw the agent)

The Snare Agent Manager controls the licenses that are required for the Snare enterprise agents to function.

The Snare Agent Manager license is generated by Intersect Alliance based on the Key Ids where it is installed.  When a new license is required ensure these Key Ids are provided by copying them to clipboard.

Quotas and Allowances

For each feature we have the number of allowances, so if you have IA_LOG=20, then you have twenty agents that have the ability to use that feature. Any enterprise agents will count towards that total including legacy (pre-v5), exception is OPENSOURCE (you may run as many as you like).

overlimit and under 60 days

If you have used 30 agents, and set up scan and SAM will see 30 agents.  The feature IA_LOG then goes into state=OVERLIMIT - so we have triggered a 60 day period for you to contact your rep/or manipulate the environment to only use 20 agents or less i.e come back to your allowance

overlimit and over 60 days

eg get to 61 days and we still have 30 agents;

  now unlicense as many v5 agents first until get to an exhausted state.  So if 15 v4 agents and 10 v5 agents, then will unlicense the 5 v5 agents until it goes back to limit of 20 - then OVERLIMIT will become EXHAUSTED

eg get to 61 days and we still have 30 agents, 25 v4 agents plus 5 v5 agents;  it will unlicense ALL the v5 - since more v4 agents than the license spots so can't get back to EXHAUSTED, and will always be OVERLIMIT.

SAM wants to be exhausted and not overlimit state.

-all (can only be v5) agents that become unlicensed will cease logging

-bring it back under or at (ie exhausted) , then rescan, and then okay.

AVAILABLE

the number of features available

EXHAUSTED

when the full license feature capability is used, eg IA_LOG=20 and 20 are utilized.

**EVALUATION

Snare Enterprise Agent

The Snare Enterprise Agent will display the display the active licenses registered to your organization.  You may license your agent depending on your network set up.

• If your agent is installed on a network then you also have Snare Agent Manager (SAM) installed that may push out all the licenses to your installed agents.
• If you have a standalone agent, installed on your desktop or device, then you will require to submit your Key IDs via the Snare License and Download Manager (SLDM), and add that license to your agent.

If SAM licenses the agent, then will see that in Licenses | page and it will be called LICENSE-TYPE= not full and not evaluation but another, so will know when SAM does it.

Example: Customer A was evaluating Snare Ent Agents utilizing SAM, in which they received 2 licenses - both for SAM (1 root and 1 feature license).   Cust A has purchased Snare, what the happens with the licenses/what do you need?

PO phase gone through to completed - they have to supply the KEY IDS into SAM - the full licenses will be auto generated and will expire within purchased timespan.  During PO submission user will have the ability to download evals for the full license allotment of the PO (for default 30 days or so) - when they pay they will get full licenses.

The second evals can be added to SAM.

So when they get full licenses, they can add them to SAM (the others might be obsolete).

Obsolete Licenses

(and if staying at same usage count) the customer is renewing licenses in advance (ie on 12 month support and renewing), we will issue them with new licenses for duration of the 14 months but obsolete existing licenses that they have but will have a 2 month window where they can have double the licenses. (just for my info).

if changing usage count and upping the amount,